CVE-2026-44576PoC(vercel / next.js)

LOWCVSS 5.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for vercel next.js systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.

vercel CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7

Weakness type (CWE)

CWE-436

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

next.js

Threat summary

Public PoC and exploit tooling are both present
5 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 4 signals
PoC mentioned or linked in 5 signals
Peaked 1d ago at 2 mentions (2026-05-10); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

vercel

Products

next.js

Deep dive

Activity timeline5 mentions / 4d

Signal classification1 categories

PoC

5100.0%

Referenced assets1 URL

By indicator

https://github.com/dwisiswant0/next-16.2.4-pocs

Classification over time

Date	Total	Labels

2026-05-08	1	PoC1
2026-05-09	1	PoC1
2026-05-10	2	PoC2
2026-05-11	1	PoC1

Full discourse5 posts

dw1@dwisiswant0153d
PoC
CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572 https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
The post announces proof‑of‑concept code for a set of CVE identifiers via a GitHub link, indicating availability of exploit scripts but no evidence of active exploitation or patches.
4126765045576.6K
16.0K followersView on X
Nicolas Krassas@Dinosn151d
PoC
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
The message references a GitHub repository containing proof‑of‑concept code for several Next.js v16.2.4 CVEs, without detailing active exploitation, patches, or technical specifics.
144220813713.7K
158.6K followersView on X
Psycho 🎭@Psycho10k_150d
PoC
Next.js v16.2.4 Security PoC Collection CVE-2026-23870 CVE-2026-44575 CVE-2026-44579 CVE-2026-44574 CVE-2026-44578 CVE-2026-44573 CVE-2026-44581 CVE-2026-44580 CVE-2026-44577 CVE-2026-44576 CVE-2026-44582 CVE-2026-44572 https://github.com/dwisiswant0/next-16.2.4-pocs via: Pr0xy
Post summary
A GitHub repository hosts Proof‑of‑Concept exploits for several CVEs affecting Next.js v16.2.4, but there is no indication of active exploitation or vendor mitigations.
08043302.5K
455 followersView on X
termireum@termireum152d
PoC
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
A GitHub repository hosts proof‑of‑concept exploits for multiple Next.js 16.2.4 CVEs, enumerating the affected CVE IDs and providing the corresponding code.
0101810684
758 followersView on X
Huda Al-Assaf@0x0Huda151d
PoC
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
The post announces a collection of proof‑of‑concept code for multiple Next.js CVEs, linking to a GitHub repository that presumably hosts the test scripts.
020543.0K
727 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vercel	next.js	-	node.js	-

Explore more

Back to dashboard vercel CVEs next.js vulnerabilities

What researchers are saying

CVE-2026-44576

dw1[verified]@dwisiswant0PoC

The post announces proof‑of‑concept code for a set of CVE identifiers via a GitHub link, indicating availability of exploit scripts but no evidence of active exploitation or patches.

Nicolas Krassas[verified]@DinosnPoC

The message references a GitHub repository containing proof‑of‑concept code for several Next.js v16.2.4 CVEs, without detailing active exploitation, patches, or technical specifics.

Huda Al-Assaf[verified]@0x0HudaPoC

The post announces a collection of proof‑of‑concept code for multiple Next.js CVEs, linking to a GitHub repository that presumably hosts the test scripts.

Psycho 🎭@Psycho10k_PoC

A GitHub repository hosts Proof‑of‑Concept exploits for several CVEs affecting Next.js v16.2.4, but there is no indication of active exploitation or vendor mitigations.

termireum@termireumPoC

A GitHub repository hosts proof‑of‑concept exploits for multiple Next.js 16.2.4 CVEs, enumerating the affected CVE IDs and providing the corresponding code.